Glasgow City Council is responding to a cyber-incident that has caused widespread disruption across a number of its online services and may have involved the theft of customer data.

The incident was first identified early on Thursday 19 June, 2025, when the council’s ICT supplier, CGI, detected malicious activity on servers managed by a third-party provider. As a precaution, the council has taken several of these servers offline, resulting in outages affecting core digital functions used by residents and staff.

In a statement, the council confirmed that it is working closely with Police Scotland, the Scottish Cyber Coordination Centre (SC3), and the National Cyber Security Centre (NCSC) to investigate the breach. Although the full extent of the incident is still being determined, initial assessments suggest that some personal data may have been compromised.

Precautionary Warning on Potential Data Theft

At this stage, the council has not confirmed whether data has been exfiltrated or what type of information may be affected. However, officials are operating on the presumption that data submitted through unavailable web forms may have been accessed. The Information Commissioner’s Office (ICO) has been notified on this basis.

Anyone who has recently used online forms for services such as permit applications, school absence reporting, or registering births and deaths are being advised to exercise caution. The council warned residents to be especially vigilant if contacted by anyone claiming to represent the council or in possession of personal information.

“If you are contacted by someone claiming to have your data, you should contact Police Scotland on 101 or the Cyber Incident Response Helpline on 0800 1670 623,” the council said. Incidents can also be reported in person at any police station.

Glasgow City Council is currently being impacted by a cyber incident which is disrupting a number of online services and which may have involved the theft of customer data.

Read more here: https://t.co/xX8iqJnw49 pic.twitter.com/BwHuNoPenP

— Glasgow City Council (@GlasgowCC) June 25, 2025

https://platform.twitter.com/widgets.js

Key Services Affected

Taking the affected servers offline — rather than the cyber incident itself — has led to widespread service disruption. Impacted areas include:

• Planning – online access to planning applications is currently unavailable.

• Penalty Charge Notices – users cannot access evidence, make payments, or submit appeals.

• Strathclyde Pension Fund – members are unable to log in to the SPFOnline portal.

• Registrars – online booking for appointments is disabled.

• Revenues and Benefits – callback appointment booking is unavailable.

Beyond these, the following online forms and calendar are also unavailable at time of writing:

•              Permits

•              Complaints

•              Certificate Online (births, deaths, marriages)

•              Comments and Compliments

•              FOI Requests

•              Application for Footway Crossing (dropped kerbs)

•              Elections

•              Planning Enforcement

•              Planning Statutory Enforcement

•              Public Processions

•              Future Processions

•              Sign Language Interpreter Service (SLIS)

•              Glasgow Film Office Location Library

•              Pupil Absence

•              Bin Calendar

•              Taxi Complaints Form

•              Council Diary

The council confirmed that its financial systems have not been affected. No bank account, debit, or credit card information processed by these systems has been compromised.

Recommended reading

• Report: Cyber Breaches Are Tanking Share Prices
• Inside the Aftermath: What Really Happens When You Get Hacked
• AI Ushering in A “Digital Divide” in Cybersecurity, NCSC Warns

The council has stated that security experts reviewing the incident have ruled out email as the source of the breach. Council email services remain safe to use, though residents are reminded to remain cautious of messages requesting sensitive information. “The Council will never ask you for bank account details, passwords or other secure information by email,” the statement said.

Glasgow City Council has apologised for the “anxiety and inconvenience” caused by the incident. It said alternative methods of accessing key services are being explored and that updates on service recovery will continue to be shared online.

“Maintaining awareness of evolving privacy risks and data handling practices has simply become impractical for the average user,” the council added, echoing warnings from national cybersecurity agencies.